Abstract: A scalable method and apparatus that detects frequent and dispersed invariants is disclosed. More particularly, the application discloses a system that can simultaneously track frequency rates and dispersion criteria of unknown invariants. In other words, the application discloses an invariant detection system implemented in hardware (and/or software) that allows detection of invariants (e.g., byte sequences) that are highly prevalent (e.g., repeating with a high frequency) and dispersed (e.g., originating from many sources and destined to many destinations).

Abstract: Techniques are provided to move the services performed on one device to another device in a cloud computing system for a variety of reasons including failure, maintenance or upgrade of the device. A notification is received that services performed by an impacted device in a domain of a plurality of hierarchical domains need to be moved. A determination is made as to whether there are replacement resources available in the domain to perform the services, and if so, the replacement resources are automatically rendered to perform the services. The process continues to higher level domains that have a view into the capabilities of subordinate domains in order to determine where to move the services within the cloud computing system.

Abstract: A novel automatic standardization and verification process for system design requirements in a product development project is disclosed. In one embodiment, a method for automatic standardization and verification of system design requirements in a product development project using a standardization and verification tool embedded in a computer aided design (CAD) application includes obtaining a desired standardized requirement from a requirements database, retrieving compliance criteria from the standardized requirement, obtaining one or more components associated with the standardized requirement from one or more data sources, and obtaining relevant extracted and derived attributes from the one or more components, associated with the standardized requirement.

Abstract: A method and apparatus is described to select a representative signature for use in identifying content in a packet stream. The method may comprise receiving the packet stream and obtaining content from a data payload of the packet. Thereafter, a plurality of signatures is identified from the content and a complexity score or a frequency score is determined based on the content. A signature of the plurality of signatures is then selected as the representative signature based on the complexity score or the frequency score.

Abstract: Detecting attacks against computer systems by automatically detecting signatures based on predetermined characteristics of the intrusion. One aspect looks for commonalities among a number of different network messages, and establishes an intrusion signature based on those commonalities. Data reduction techniques, such as a hash function, are used to minimize the amount of resources which are necessary to establish the commonalities. In an embodiment, signatures are created based on the data reduction hash technique. Frequent signatures are found by reducing the signatures using that hash technique. Each of the frequent signatures is analyzed for content, and content which is spreading is flagged as being a possible attack. Additional checks can also be carried out to look for code within the signal, to look for spam, backdoors, or program code.

Abstract: A scalable method and apparatus that detects frequent and dispersed invariants is disclosed. More particularly, the application discloses a system that can simultaneously track frequency rates and dispersion criteria of unknown invariants. In other words, the application discloses an invariant detection system implemented in hardware (and/or software) that allows detection of invariants (e.g., byte sequences) that are highly prevalent (e.g., repeating with a high frequency) and dispersed (e.g., originating from many sources and destined to many destinations).

Abstract: An efficient streaming method and apparatus for detecting hierarchical heavy hitters from massive data streams is disclosed. In one embodiment, the method enables near real time detection of anomaly behavior in networks.

Abstract: A method and apparatus for detecting malicious attacks is described. The method may comprise obtaining routing information from a packet communicated via a network and maintaining a count of packets associated with a device associated with the routing information. For example, the routing information may a source or destination IP address, a port number, or any other routing information. The device may be classified as a potentially malicious device when the count exceeds a threshold. The count may be incremented when the TCP SYN flag is set and the TCP ACK flag is not set. An embodiment comprises obtaining a source hash of the source IP address and a destination hash of the destination IP address. Thereafter, the source hash and the destination hash may be mapped to multi stage filters. The device associated with the packet may then be selectively categorizing as a suspicious device.

Abstract: A method of video coding that includes encoding resynchronization point information, where the resynchronization point information includes information identifying a location of a resynchronization point within a section of a video bitstream and information for decoding the bitstream following the resynchronization point. Also, a method for decoding digital video that includes receiving an encoded bitstream including resynchronization point information, where the resynchronization point information includes information identifying a location of a resynchronization point and information for decoding the bitstream following the resynchronization point, decoding the received bitstream, and locating the resynchronization point in the bitstream based on the resynchronization point information.

Abstract: A device includes a multistage filter and an elephant trap. The multistage filter has hash functions and an array. The multistage filter is operable to receive a packet associated with a candidate heavy network user and send the packet to the hash functions. The hash functions generate hash function output values corresponding to indices in the array. The elephant trap is connected to the multistage filter. The elephant trap includes a buffer and probabilistic sampling logic. The probabilistic sampling logic is operable to attempt to add information associated with the packet to the buffer a particular percentage of the time based in part on the result of the multistage filter lookup. The buffer is operable to hold information associated with the packet, counter information, and timestamp information.

Abstract: An efficient streaming method and apparatus for detecting hierarchical heavy hitters from massive data streams is disclosed. In one embodiment, the method enables near real time detection of anomaly behavior in networks.

Abstract: A device includes a multistage filter and an elephant trap. The multistage filter has hash functions and an array. The multistage filter is operable to receive a packet associated with a candidate heavy network user and send the packet to the hash functions. The hash functions generate hash function output values corresponding to indices in the array. The elephant trap is connected to the multistage filter. The elephant trap includes a buffer and probabilistic sampling logic. The probabilistic sampling logic is operable to attempt to add information associated with the packet to the buffer a particular percentage of the time based in part on the result of the multistage filter lookup. The buffer is operable to hold information associated with the packet, counter information, and timestamp information.

Abstract: A method and apparatus for multi-layer integration for use in error recovery is disclosed. An error is detected in a multimedia data based on a first layer protocol and the detected error in the multimedia data is concealed based on a second layer protocol. In one aspect, the error in a multimedia data is detected based on a communication layer protocol and controlled based on a transport layer protocol. An error distribution of the controlled error is then determined based on a sync layer protocol and the detected error in the multimedia data is concealed based on an application layer protocol. In another aspect, a method and apparatus for multimedia data processing comprises error recovery as well as scalability. Finally, a method and apparatus as disclosed allows processing of multimedia stream by receiving multiple streams of encoded multimedia data, performing error recovery on an erroneous portion of a stream, and reconstructing the multimedia data from the multiple streams.

Abstract: Apparatuses, methods, and other embodiments associated with packet identification are described. One example apparatus includes a packet selection logic to identify packets associated with a data stream. The example apparatus may also include a set of packet classification logics. A packet classification logic may generate a signal as a function of whether an attribute associated with the packet matches an attribute associated with packets generated by a tested application.

Abstract: A scalable method and apparatus that detects frequent and dispersed invariants is disclosed. More particularly, the application discloses a system that can simultaneously track frequency rates and dispersion criteria of unknown invariants. In other words, the application discloses an invariant detection system implemented in hardware (and/or software) that allows detection of invariants (e.g., byte sequences) that are highly prevalent (e.g., repeating with a high frequency) and dispersed (e.g., originating from many sources and destined to many destinations).

Abstract: Universal connection data collection solution for monitoring, collecting and reporting connection data and/or attributes for endpoint computing devices making a connection to a network for use in analyzing user behavior and device connectivity efficiencies. Embodiments include IP connections wherein the universal connections data collection module is notified by the OS of IP connection events. Embodiments may include a standalone mode of the universal connections data collection solution and add-on modes wherein the universal connections data collection solution integrates with a third party connection manager using an API to communicate. The universal connections data collection solution monitors the state of network connections by enumerating connections, comparing the list of active connections to the last known snapshot of the network state to determine a network state change (e.g., new connection, change in connection state, disconnection), and periodically updating the statics of the connected network.

Abstract: A method and device to process a packet received by a network device is described. The method may comprise analyzing the packet to identify at least one set of a plurality of sets, mapping the at least one set to at least one functional unit, and performing functionality associated with the at least one functional unit. Analyzing the packet to identify at least one of a plurality of sets may comprise determining when the packet includes at least one set identifier, and identifying the at least one set based on the at least one set identifier. A set status identifier may be defined for each set, the set status identifier indicating when set identifiers associated with a corresponding set are detected in the packet. The device may be a router, switch or any other device that processes digital data e.g., packet data including packets headers, payload or the like.

Abstract: Embodiments of the present disclosure provide techniques for distributing information about possible anomalies in a network. A sensor in a network may detect packets with payloads that match an anomaly signature. Address dispersion information, for example, in the form of source and address bitmaps, may be gathered at the sensor. The address dispersion information may be distributed to one or more peer sensors if the information indicates that the number of different addresses of the detected matching packets exceeds a threshold.

Abstract: A method and apparatus is described for identifying content in a packet. The method may obtain data sample from the packet where the data sample is in a predetermined window at an initial offset point in the packet. For each offset point, a first stage of processing on the data sample may be performed to identify if the data sample corresponds to potentially relevant reference string. A more focused second stage of processing may then be carried out on the data sample to identify if the data sample corresponds to potentially relevant reference string. Thereafter, an even more focused third stage of processing may be carried out on the data sample to obtain a third stage result. If the data sample passes all three stages of processing, a predefined action is identified which is associated with a reference string corresponding to the data sample.

Abstract: A method and apparatus is described to process packets in a network. The method may comprise receiving the packet and determining a length K of the packet. If the length of the packet is less than a reference length M then no analysis may be performed on the packet. However, if the packet length K is not less than M, the method may determine if the packet length K is at least greater than a reference window size WRef. When the packet length is greater than WRef then a window size W for the processing of the packets is set equal to WRef; and the packet length is less than WRef then a window size W for the processing of the packets is set equal to the packet size K. Thereafter, the packet is processed using the window size W.